---
title: Troubleshooting
description: Common issues and solutions for the Datadog Code Security MCP Server.
breadcrumbs: >-
  Docs > Datadog Security > Code Security > Developer Tool Integrations > Code
  Security MCP Server > Troubleshooting
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Troubleshooting

{% callout %}
# Important note for users on the following Datadog sites: app.ddog-gov.com, us2.ddog-gov.com

{% alert level="danger" %}
This product is not supported for your selected [Datadog site](https://docs.datadoghq.com/getting_started/site.md). ({% placeholder "user-datadog-site-name" /%}).
{% /alert %}

{% /callout %}

If you experience issues with the [Datadog Code Security MCP Server](https://docs.datadoghq.com/security/code_security/dev_tool_int/mcp_server.md), use the following solutions to diagnose and resolve common problems.

{% alert level="info" %}
This MCP server is separate from the [Datadog MCP Server](https://docs.datadoghq.com/mcp_server.md), which provides cloud-based access to Datadog features and data. The Code Security MCP Server runs locally and focuses on code-level security scanning.
{% /alert %}

## Binary not found{% #binary-not-found %}

If a scan returns an error about a missing binary, list every required scanner:

```shell
datadog-code-security-mcp version --detailed
```

Install a missing binary with the instructions in [Install security binaries](https://docs.datadoghq.com/security/code_security/dev_tool_int/mcp_server.md#install-security-binaries). After you install the agent skills, `dd-codesec-setup-toolchain` installs, updates, and diagnoses the same binaries. See [Install agent skills](https://docs.datadoghq.com/security/code_security/dev_tool_int/mcp_server.md#install-agent-skills).

## Scanner upgrade required{% #scanner-upgrade-required %}

Ephemeral SAST scans and saving custom SAST rules require `datadog-static-analyzer` version 0.9.10 or later. With an earlier version, they return a `Scanner Upgrade` error. Upgrade the binary and retry:

```shell
brew upgrade datadog-static-analyzer
```

## Authentication errors{% #authentication-errors %}

Keys set in the MCP server configuration are not exported to your shell. `echo $DD_API_KEY` shows only a key exported in that shell, which is what a direct CLI command uses.

- For the MCP server, confirm `DD_API_KEY` and `DD_APP_KEY` are set in the client configuration on the [Code Security MCP Server](https://docs.datadoghq.com/security/code_security/dev_tool_int/mcp_server.md) page.
- For a direct CLI command, export `DD_API_KEY` and `DD_APP_KEY` in the same shell. Optionally export `DD_SITE`.

If the values are set but scans still fail, verify your keys have the correct permissions. See [API and Application Keys](https://docs.datadoghq.com/account_management/api-app-keys.md) for details.

## Custom SAST rule not saved{% #custom-sast-rule-not-saved %}

Ephemeral scans work without Datadog keys, but saving a rule requires `DD_API_KEY` and `DD_APP_KEY`. See the Authentication errors section.

If the rule does not report the expected number of findings on its two examples, or fails on them, nothing is saved. If the error says an example was not scanned, rename the example file so its extension matches the rule's language, for example `.ts` for `TYPESCRIPT`. Otherwise, fix the rule and retry.

If Datadog creates the rule but rejects its content, the error reports that the rule was left empty. Fix the cause the error reports, then retry with `overwrite: true` (`--overwrite` in the CLI) to replace the empty rule.

If a rule with the same name already exists, nothing is saved. Choose another rule name, or retry with `overwrite: true` (`--overwrite` in the CLI) to replace the existing rule.

## MCP server not responding{% #mcp-server-not-responding %}

1. Check that the binary is installed and accessible:

   ```shell
   datadog-code-security-mcp version
   ```

1. Check MCP server logs:

   ```shell
   tail -f ~/Library/Logs/Claude/mcp*.log
   tail -f ~/.claude/logs/mcp*.log
   ```

1. Verify your client configuration points to the correct binary path. If installed through Homebrew, the binary should be on your `PATH`. Otherwise, use an absolute path in your configuration.

## Partial results{% #partial-results %}

When running a comprehensive scan, some scan types may succeed while others fail (for example, if only some binaries are installed). The server returns:

- Results from all successful scanners.
- Error messages with installation instructions for any scanners that failed.

This is expected behavior. Install the missing binaries and re-run to get complete results.

## Further reading{% #further-reading %}

Additional helpful documentation, links, and articles:

- [Code Security MCP Server overview and setup](https://docs.datadoghq.com/security/code_security/dev_tool_int/mcp_server.md)
- [Tools Reference](https://docs.datadoghq.com/security/code_security/dev_tool_int/mcp_server/tools_reference.md)